FAQ about the Dept. of Revenue hack attack

Here are some of the most common questions we've been asked, and the best answers we've been given from state officials, since it was announced that 3.9 million South Carolina tax returns and 387,000 credit and debit card numbers had been exposed in a hacker attack at the state Department of Revenue.

New information as of October 22, 2013

On Thursday, October 24, South Carolina residents started enrolling for the stateâ??s newest credit monitoring program, CSID.

CSID is available to any individual who filed a state tax return ELECTRONICALLY from 1998 to 2012. After the hack, the state determined the hackers only compromised the information of electronic filers, not those who filed paper returns. If you filed by paper return, you will not be eligible for this coverage, like you were with Experian. Experian credit monitoring was open to everyone in South Carolina, because at the time, the state was not sure who was affected. Now, because they have narrowed that down, they're only offering the CSID protection to those who were affected, i.e. those who filed electronically.

After the tax returns of millions of people were compromised when the Department of Revenue computer servers were hacked last year, the state offered free credit monitoring through Experian. Now the state is going with a new company, CSID, to provide those services.

People will have to pay to extend Experianâ??s service, or sign up through the new company, CSID, for free services.

CSID will protect against fraud and identity theft for taxpayers, and their dependent children, and businesses.

The Department of Revenue said CSID will monitor a wider array of databases to detect the fraudulent use of personal information, which includes chat rooms where cyber thieves will sometimes buy and sell identity information.

CSID also allows people to work with a restoration specialist to get your identity restored.

The SC Department of Revenue says residents whose tax information was compromised in the 2012 hacking of the DOR servers should wait before making a decision about the continued credit monitoring services offered by any vendor, including Experian.

"The state Budget and Control Board is in the process of reviewing bids and a formal announcement will be made next week as to which vendor was chosen to offer credit and identification protection," said Samantha Cheek, spokesperson for the SCDOR. "The vendor will work alongside the state of South Carolina to promote and educate the public on the protection service."

Cheek said the state would have a plan in place by October 24, 2013, before the free Experian service provided by the state lapsed.

New information as of January 16, 2013

The DOR began sending out letters to those affected by the hack on December 10th. They were sent to out

-

of

-

state residents first, and they are now arriving to in

-

state residents. They are being sent out by zip code, from lowest to highest. They hope to have all the letters out by the end of January.

If you receive a letter, the DOR recommends that you sign up for the free credit monitoring service, Experian (see below for a link and sign up information)

, but even if you don't receive a letter, they advise you to sign up

.

New information as of December 21, 2012

South Carolina taxpayers affected by the information security data breach at the South Carolina Department of Revenue now have until March 31, 2013, to sign up for a year of free credit monitoring and unlimited fraud resolution provided by Experian.

Gov. Nikki Haley says that taxpayers will start receiving notification letters Monday, November 10th if their personal financial data was stolen in massive cyber-attack thought to be the largest ever at a state agency.

Governor Nikki Haley says taxpayers who claim minors as dependents and who have been affected by the South Carolina Department of Revenue security breach should start receiving notification from Experian by email or letter with instructions about how to sign up for Experian's Family Secure identity monitoring service.

In a press conference on November 20th, Governor Nikki Haley announced Jim Etter, the Department of Revenue director, has given his letter of resignation in wake of the Department of Revenue hacking.

Haley stated that Etter will be with the department until December 31.

Haley released the information about Etter's resignation after releasing a report on a cyber-attack on South Carolina's tax collection agency shows officials could have done more to protect the personal information of nearly 4 million individual filers and 700,000 businesses.

Governor Haley also announced the state now knows who was impacted by the hack and anyone affected will be contacted by mail.

She also released the following numbers on the number of people impacted:

Filers impacted: 3.9 million

Dependents: 1.9 million

Businesses: 699,900

Bank Accounts: 3.3 million, some of which are closed

Credit Cards: 5,000, all of which have expired

New information as of November 7, 2012

On November 7th, SC officials said 200,000 more tax returns were hacked than they first thought, which puts the new total number of residents affected by an international cyber attack at 3.8 million.

A computer experts with the information-technology company, Mandiant, told a Charleston newspaper the hacker apparently breached state databases using two different paths.

The Mandiant spokesman said the hacker tricked a user inside the SC Revenue Department into opening a file that contained a virus and allowed the hacker to access the system.

The spokesman also said using a stolen credential, the hacker was able to take the information.

As of now, it's still not clear exactly whose information has been hacked. The Revenue Department said on October 28th, it could be two weeks before you find out if your personal information is at risk. That two weeks is up on Sunday.

We also asked about protecting children's identities. The plan is still in place to offer Family Secure (see more information below). According to the state Department of Revenue, "A parent or guardian will be notified several weeks after registration when Family Secureâ?¢ enrollment has opened by postal mail or email."

Q: Who is impacted?

A: The state says anyone who filed a personal tax return or a business tax return since 1998 in the state of South Carolina could be at risk.

Q:How do I know if my personal information has been stolen?

A: There's no way to know for certain right now. According to state officials, the Department of Revenue will notify those taxpayers whose returns were hacked. The state is still going through the files to determine exactly whose information is in jeopardy. Keep in mind, though, that 3.6 million Social Security numbers represents nearly 80 percent of all South Carolina residents, so there's a good chance your information is at risk.

Q: When will I know if my personal information has been compromised?

A: It could be weeks or months before you find out if your identity has been stolen. Experts suggest you check your credit and debit card accounts often and if you notice fraudulent charges, contact your credit card company or bank immediately. Gov. Haley has said that identity thieves may wait six to eight months to put stolen identity information to use, but that after a year, the likelihood of that information being used for fraudulent purchases goes down. But other experts tell NewsChannel 15 that the threat can extend for years.

Q: What is the state doing now to help me monitor my credit information?

A: The revenue department is urging anyone, even if you've moved out of state, who has filed a South Carolina tax return since 1998 to contact the credit monitoring service Experian. The state is providing one year of free credit monitoring service to those taxpayers. Go to the ProtectMyID web site (www.protectmyid.com/scdor) and enter the code SCDOR123 (make sure you use all capital letters) in the "activation box" to sign up. Former and current South Carolina residents are permitted to use this code. You have until January 31, 2013 to sign up. If you were not affected or are found to be ineligible, you can continue the service at your own expense, or the account will be terminated. Make sure you hit the "logout" button at the top right hand corner of the screen before trying to create another account for a spouse or family member. You can also call 1-866-578-5422 to enroll. The call center is open 9:00 AM - 9:00 PM EST on Monday through Friday and 11:00 AM - 8:00 PM EST on Saturday and Sunday.

The complimentary 12-month ProtectMyID memberships available to South Carolina taxpayers affected by the DOR information security breach include:

- Credit Report: A free copy of your Experian credit report.

- Daily 3 Bureau Credit Monitoring: Alerts you of suspicious activity including new inquiries, newly opened accounts, delinquencies, or medical collections found on your Experian, Equifax® and TransUnion® credit reports.

-Identity Theft Resolution: If you have been a victim of identity theft, you will be assigned a dedicated, U.S.-based Experian Identity Theft Resolution Agent who will walk you through the fraud resolution process, from start to finish.

- ExtendCARE: Full access to the same personalized assistance from a highly-trained Fraud Resolution Agent even after your initial ProtectMyID membership expires.

- $1 Million Identity Theft Insurance: As a ProtectMyID member, you are immediately covered by a $1 Million insurance policy that can help you cover certain costs including, lost wages, private investigator fees, and unauthorized electronic fund transfers.

Q: What about the Internet Scanning Service that is $15.95 a month from Experian? Is that included in what the state is offering?

Q: So what happens after the year of free monitoring through Experian? Are we just on our own?

A: According to Governor Nikki Haley, the service includes a year of daily monitoring of the three credit bureaus and a lifetime of over-the-phone help on resolving identity theft after it happens.

Q: I tried to sign up, but it told me the promotional code was invalid.

A: Make sure you're typing the code in all capital letters with no spaces or dashes in it. SCDOR123. Also be sure you're going to the correct website: www.protectmyid.com/scdor. If you don't have the /scdor at the end of the web address, it will take you to Experian's main website, which means you're signing up for a paid service.

Q: What about my business's credit information? Could that be compromised, too?

A: Gov. Nikki Haley said information from up to 657,000 businesses was also exposed in the hack. Dun & Bradstreet Credibility Corp. is launching free credit reports for all South Carolina businesses that have filed a tax return since 1998. The company will offer a CreditAlert product that will alert customers to changes taking place in their business credit file. Even something as simple as a change to a business address or a company officer change would set off an alert to the business owner. Business owners can visit http://www.dandb.com/sc/ beginning Friday, Nov. 2, or they can call customer service toll free at this dedicated phone number: 1-800-279-9881. This free service is being provided at no cost to the business or the state. The free service is for the life of the business.

Experian is offering those impacted South Carolina businesses Business Credit AdvantageSM - a self-monitoring service that allows unlimited access to a company's business credit report and score. South Carolina businesses can sign up for Business Credit AdvantageSM at http://www.smartbusinessreports.com/SouthCarolina.

Q: What about my children?

A: The Revenue Department advises that if a parent had included a child's information on a tax return, they should sign up those children for Experian's ProtectMyID Family Secure program. Those individuals who enroll in ProtectMyID will soon get an email or letter alerting them to the availability of Family Secure and how to register their minors who were listed on tax paperwork as dependents. (See below for more information about Family Secure)

Q: Could my credit card information be at risk?

A: According to the governor, all of the credit and debit card information that was stolen is from expired accounts.

Q: How and when did this security breach happen?

A: State officials say the attack was mounted from a computer with an international IP address. They say the attack was found in early October, but they have not given many details because of the ongoing investigation.

Q: I've received an email from a credit reporting agency telling me that my credit information may have been used illegally and asking me to click their link to "secure my credit." How do I know if this email is legitimate?

A: Department of Revenue spokesperson Samantha Cheek tells NewsChannel 15 consumers should be suspicious of any unsolicited contact from a company or agency that claims your personal information has been compromised. She suggests you sign up for the Experian service (see above) or contact one of the other major reporting agencies (Equifax and TransUnion are the others) to check your credit report before signing up for any other service that may claim it will help secure your credit.

Q: If I sign up for the free year of monitoring with Experian, what about the other two credit monitoring companies?

A: Experian will also track your information through Transunion and Equifax if you're on the affected list.

Q: What about members of the military?

A: Governor Haley said for those in the military, the state is working with the Department of Defense to make sure military members are notified.

Q: What about someone who is now deceased, but had paid taxes in SC since 1998?

A: According to Greg Young, Director, Public Relations, Experian Consumer Services, it is not necessary to sign the deceased up for ProtectMyID. However, action to protect their credit should be taken. The deceased should be noted in credit reports as such, via a deceased indicator. You can request a copy of the deceased's credit report from each of the credit bureaus (Experian, Equifax and TransUnion) via a mailed request and verify the report has the deceased indicator.

The request needs to be made by a surviving spouse or anyone with power of attorney. Also, if the individual has been deceased for a while, there is a chance the credit report no longer exists.

It is important to note that ProtectMyID does not provide any means to address this concern. It must be taken care of via the credit bureaus.

According to Greg Young, Director, Public Relations, Experian Consumer Services, if a dependent is over 18, he or she should register with ProtectMyID.com/scdor.

If the dependent is younger than 18 (born after 1994), after the adult who claims the child as a dependent signs up through protectmyid.com/scdor, you will soon get an email that a program called Family Secure is available to you. That will be a different registration process, where you can monitor the identities of any minors. Those emails should go out sometime soon. Family secure will also be free to eligible taxpayers who's information was compromised.

Here's the information from Greg Young.

Process:

â?¢ Those individuals that already enrolled in ProtectMyID® will get an email alerting them to the availability of Family Secure and how to register their minors who were listed on tax paperwork as dependents.

â?¢ Those that have not registered yet with the ProtectMyID product will be sent an email with Family Secure registration directions upon completing the ProtectMyID registration.

Requirement:

â?¢ Individuals must sign up for ProtectMyID first. Once they are registered, notification and a registration code (different from the one used for ProtectMyID) will be sent to them, with directions what to do to register with Family Secure. If they do not have minors listed as dependents, then they can ignore the notice. As with ProtectMyID, the Family Secure registration process may be completed via the phone with a live representative. For the Family Secure product, an email address is required.

â?¢ Parents register their children as part of Family Secure.

â?¢ The primary benefit that Family Secure brings to bear in this situation is that it monitors the identity (primarily the SSN) of the minor who has no credit report - thus no alerts. Once registered, in the event a child does have a credit file, if any credit, loan or similar account is opened with that information, the parents are alerted to call customer care. (Detail of the alert on minors is not released unless or until the Parent authenticates themselves with customer care as the parent or guardian of the minor.)

Family Secure features:

Coverage:

â?¢ One adult

â?¢ Any amount of minors (5 are allowed to enroll on the website; for more than 5, the customer must call Customer Care)

Key Benefits the adult receives:

â?¢ $2 million product Guarantee covers the whole family

â?¢ Score Tracker

â?¢ Fraud Resolution

Benefits the minors receive:

â?¢ Monthly monitoring for existence of minor's credit report

â?¢ If a credit report is found, then we monitor for any changes to that report

If you have a question, leave a comment below or email us at yournews@wpde.com and we'll work to get an answer for you.